CVE-2011-4833

{"id": "CVE-2011-4833", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2011-12-15T03:57:34.967", "references": [{"url": "http://secunia.com/advisories/47011", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1026369", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/77459", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/520685/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.sugarcrm.com/crm/support/bugs.html#issue_47800", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.sugarcrm.com/crm/support/bugs.html#issue_47805", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.sugarcrm.com/crm/support/bugs.html#issue_47806", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.sugarcrm.com/crm/support/bugs.html#issue_47839", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71586", "source": "cve@mitre.org"}, {"url": "https://www.htbridge.ch/advisory/sql_injection_in_sugarcrm.html", "tags": ["Exploit"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in the Leads module in SugarCRM 6.1 before 6.1.7, 6.2 before 6.2.4, 6.3 before 6.3.0RC3, and 6.4 before 6.4.0beta1 allow remote attackers to execute arbitrary SQL commands via the (1) where and (2) order parameters in a get_full_list action to index.php."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de inyecci\u00f3n SQL en el m\u00f3dulo Leads en SugarCRM v6.1 antes de v6.1.7, v6.2 antes de v6.2.4, v6.3 antes de v6.3.0RC3, y v6.4 antes de v6.4.0beta1, permite a atacantes remotos ejecutar comandos SQL de su elecci\u00f3n a trav\u00e9s de los par\u00e1metros (1) where y (2) order, en una acci\u00f3n get_full_list en index.php"}], "lastModified": "2018-10-09T19:33:36.077", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sugarcrm:sugarcrm:6.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C16E5EC2-5F12-4295-A1DC-84D483B41B11"}, {"criteria": "cpe:2.3:a:sugarcrm:sugarcrm:6.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ABD86E19-E2CF-4A06-9A33-DD225A6014F8"}, {"criteria": "cpe:2.3:a:sugarcrm:sugarcrm:6.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0E852A2C-DA3A-41AD-A3F5-8E687FF261FC"}, {"criteria": "cpe:2.3:a:sugarcrm:sugarcrm:6.1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2203D0CE-50B8-4B84-9243-7E9014C4B03B"}, {"criteria": "cpe:2.3:a:sugarcrm:sugarcrm:6.1.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1AF1D67F-A948-434D-BF20-C57146E057A0"}, {"criteria": "cpe:2.3:a:sugarcrm:sugarcrm:6.1.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "895944DB-051F-4AF4-822E-FCBB2AC9740C"}, {"criteria": "cpe:2.3:a:sugarcrm:sugarcrm:6.1.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D8FBCC3B-8EBB-4D38-BEF2-633AB22679A5"}, {"criteria": "cpe:2.3:a:sugarcrm:sugarcrm:6.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9547CE36-62A8-443D-BB64-52450F73D2BC"}, {"criteria": "cpe:2.3:a:sugarcrm:sugarcrm:6.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "22243D9F-63DD-48F6-AFB0-40E1F0CDC426"}, {"criteria": "cpe:2.3:a:sugarcrm:sugarcrm:6.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2DF47CAC-2F55-4599-96D1-6844DBCE249B"}, {"criteria": "cpe:2.3:a:sugarcrm:sugarcrm:6.2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DA0F7430-D811-4063-BF9C-7CCC518C2A47"}, {"criteria": "cpe:2.3:a:sugarcrm:sugarcrm:6.3.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F02CEA83-1236-479C-AAB9-97132A258344"}, {"criteria": "cpe:2.3:a:sugarcrm:sugarcrm:6.3.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D7CEE2FF-357A-479B-A43A-59C3FBB4682B"}, {"criteria": "cpe:2.3:a:sugarcrm:sugarcrm:6.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "445AB068-5FC6-4E34-9112-3DE3E81EC070"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}